For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Fletcher_Cocquy's avatar
Fletcher_Cocquy
Icon for Nimbostratus rankNimbostratus
Jul 28, 2006

Throttling iRule for webapplications

Hi, does anyone have an iRule suitable to throttle connections to a set of URI's (webapplications)?

 

The problem we are trying to solve is the intentional (or unintentional in the case of the aggressive webcrawler) Denial of Service (DoS)'ing of these webapps which each have their own rate limits (before their database connections are all used up and their back up the apache threads and everything on the shared infrastructure comes to a grinding halt)

 

 

So a variation of this iRule:

 

http://devcentral.f5.com/Wiki/default.aspx/iRules/RateLimit_HTTPRequest.html

 

is what I am looking for.

 

 

With a set of URI's mapped to their rate limits.

 

When the max number of connections is reached the Max+1 th request gets the "Service Unavailable" message

 

 

Assume these webapps are all publicly available (by design and necessity)

 

 

Thought I'd check before attempting to code my own

 

 

thanks,

 

Fletcher.
application delivery
dev
devops
iRules

3 Replies

  • Joe_Pruitt's avatar
    Joe_Pruitt
    Jul 28, 2006
    Hi Fletcher,

     

     

    There aren't any that I know of that do exactly this, but the one you referenced shouldn't be that far off so you'll have something to start with.

     

     

    If you come up with one, please post it back here to either the forums or the CodeShare as I'm sure others would benefit from your work! Or better yet ..., build it with the iRule Editor and share it that way!

     

     

    -Joe
  • Fletcher_Cocquy's avatar
    Fletcher_Cocquy
    Icon for Nimbostratus rankNimbostratus
    Jul 31, 2006
    I found an apache module that will do exactly what I need with one directive:

     

     

    http://dominia.org/djao/limitipconn2.html

     

     

    thanks,

     

    F

     

     

    PS: I like the iRule editor - suggestion: can you add a Subversion module so we can check in changes directly to revision control?

     

  • Joe_Pruitt's avatar
    Joe_Pruitt
    Aug 03, 2006
    Not sure if the editor will include subversion support as I'd like to limit the amount of external code dependencies. But, you can use the export feature to export the rules to a local folder. Then use TortoiseSVN on that folder to link it to a source repository. The Editor even has an option to open the local iRule archive folder for you and then you can check-in your rules as you wish.

     

     

    -Joe